Filestash is a file-management and cloud-storage gateway product with a focused vulnerability footprint centered on cryptographic and certificate-handling weaknesses, including improper certificate validation, cryptographic signature verification flaws, and insecure default initialization. Treat this as a compact vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Filestash over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-41255HIGH filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init funct | Jul 31, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-41256MEDIUM Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verificat | Jul 31, 2024 | 5.9 | 18 | NO | NO |
CVE-2024-41258MEDIUM An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information | Jul 31, 2024 | 5.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Filestash.
Media articles that mention a CVE ID that affects a product developed by Filestash — matched by CVE ID, not by vendor name.